reporting

Overview

The engagement is not finished when you capture the flag — it is finished when someone can act on what you found. Reporting is the fifth phase: turning your evidence package into a clear write-up that communicates what you did, what it means, and what should be done about it. A strong report is the single most valuable deliverable of real security work, because it is what drives fixes.

This lesson covers the structure of a good engagement write-up — summary, findings, impact, remediation, and severity — and how to write it for the people who will read it. Everything reported concerns the authorized lab target and is grounded in the evidence you captured.

Learning objectives

• Structure an engagement report: summary, findings, impact, remediation, severity.
• Write for both technical and non-technical readers.
• Ground every claim in captured evidence and reproducible steps.
• Rate severity in a consistent, justifiable way.

Core concept

A report communicates findings so they can be understood and remediated. Its power comes from clarity and evidence, not from technical flourish. A good report answers, for each finding: What is the issue? How do we know (evidence)? Why does it matter (impact)? How serious is it (severity)? What do we do (remediation)?

Reports serve different readers at once. A leader needs the summary and the impact; an engineer needs the reproduction steps and the remediation. Good structure lets each reader find what they need without wading through the rest.

How it works

A conventional engagement report contains:

• Executive summary — a short, plain-language overview: what was tested (the scope), what was found at a high level, and the overall risk. Written so a non-specialist can grasp it.
• Findings — each issue described in detail, with the reproducible steps and the evidence (screenshots, logs, hashes) captured in the previous phase. This is where reproducibility from your records proves its worth.
• Impact — what the finding actually allows: what data or access is exposed, and what that means in business or mission terms. Impact answers "so what?"
• Severity — a consistent rating (for example, informational through critical) that reflects both how easy the issue is to exploit and how bad the consequences are. Severity lets the reader prioritize; chained findings may warrant a higher combined severity than any single link.
• Remediation — clear, actionable guidance to fix each finding, ideally tied to the defensive lessons from earlier modules (input validation, least privilege, allowlisting, and so on). This is the payoff: the report exists to get things fixed.

Findings are usually ordered by severity so the most important issues are seen first.

Practical example

For the lab chain, your report might read:

• Summary: "The authorized lab web application was assessed. An authentication weakness chained with an upload feature allowed retrieval of a protected flag, demonstrating full compromise of the application's intended access controls. Overall risk: high."
• Finding 1 — Authentication bypass. Reproduction steps and the screenshot/log evidence; impact: unauthorized access to the administrative area; severity: high; remediation: enforce correct authentication checks and validate input.
• Finding 2 — Unrestricted file handling via upload. Steps and evidence; impact: enabled the pivot that reached the flag; severity: high (critical in combination with Finding 1); remediation: restrict and validate uploads, apply least privilege.
• Chained impact note: individually serious, the two findings together produced full objective compromise — reported as a combined critical chain.

Each claim points back to a specific, hashed piece of evidence, so the report is verifiable end to end.

Cybersecurity relevance

In industry, the report is the product — clients and teams act on the write-up, not on the tester's memory. Poorly communicated findings get ignored; well-structured, evidence-backed, appropriately-severe findings get fixed. Consistent severity ratings let organizations triage limited remediation time. Tying remediation to sound defensive practice closes the loop between offense and defense, which is the entire point of authorized testing: to make systems safer.

Common mistakes

• No executive summary, so decision-makers cannot grasp the risk quickly.
• Findings without evidence or steps, which cannot be trusted or reproduced.
• Vague or inconsistent severity, making prioritization impossible.
• Missing remediation, leaving the reader knowing there is a problem but not how to fix it.
• Ignoring chained impact, understating risk by rating each link in isolation.

Key takeaways

• A report turns evidence into action; its structure is summary, findings, impact, severity, and remediation.
• Write for multiple audiences: a plain-language summary and impact for leaders, reproducible steps and fixes for engineers.
• Ground every claim in the captured, hashed evidence, and order findings by severity.
• Actionable remediation tied to defensive principles is the report's ultimate purpose; account for chained impact.

Check your understanding

• What are the five core sections of an engagement report, and which reader does each primarily serve?
• Why can chained findings deserve a higher combined severity than any single finding alone?